Submit a ticketCall us

Training ClassSign up for Network Performance Monitor (NPM) and Scalability instructor-led classes

Attend our instructor-led classes, provided by SolarWinds® Academy, to discuss the more advanced monitoring mechanisms available in NPM as well as how to tune your equipment to optimize its polling capabilities. NPM classes offered:
NPM Custom Monitoring and Polling
Orion Platform Scalability

Reserve your seat.

Home > Success Center > Server & Application Monitor (SAM) > SAM - Knowledgebase Articles > WMI or agent polling causes high CPU utilization on monitored Windows nodes

WMI or agent polling causes high CPU utilization on monitored Windows nodes

Created by Tiarnan Stacke, last modified by An Kian Wong on Jul 09, 2018

Views: 1,249 Votes: 0 Revisions: 12


When polling a node via WMI, the WMI process on the target machine experiences high CPU utilization.

This issue may be experienced with SolarWinds agents when a job engine worker gets a spike in CPU utilization.


All SAM versions 



This is caused by

  1. A large amount of Windows Event Log monitors, Asset inventory and Appinsight was applied to the server.This issue is seen on machines like domain controllers that have large event logs or application servers with large application, security and event logs.
  2. Low allocation of CPU core(s) to the server which does not have sufficient processing compute to process the events logs.


  • Reduce the amount of event logs on the server.
  • Review the Appinsight components and disable if not required.
  • Reduce polling intervals on the application monitor.
  • Reduce the scope of the Windows Event Log monitors. For example, look for less Event IDs, and so on.
  • Identify and change the template polling method from WMI to RPC. For a comparison of difference in protocol, refer to WMI vs RPC vs SNMP.




Last modified